libssh (0.9.6-2ubuntu0.22.04.7) jammy-security; urgency=medium

  * SECURITY UPDATE: out-of-bound read
    - debian/patches/CVE-2026-3731.patch: correct bounds checks when querying
      for an SFTP extension name or data in src/sftp.c.
    - CVE-2026-3731

 -- Ian Constantin <ian.constantin@canonical.com>  Wed, 11 Mar 2026 12:19:27 +0200

libssh (0.9.6-2ubuntu0.22.04.6) jammy-security; urgency=medium

  * SECURITY UPDATE: memory leak in key exchange
    - debian/patches/CVE-2025-8277-1.patch: adjust packet filter to work
      when DH-GEX is guessed wrongly in src/packet.c.
    - debian/patches/CVE-2025-8277-2.patch: fix memory leak of unused
      ephemeral key pair after client's wrong KEX guess in src/dh_crypto.c,
      src/dh_key.c, src/ecdh_crypto.c, src/ecdh_gcrypt.c,
      src/ecdh_mbedcrypto.c.
    - debian/patches/CVE-2025-8277-3.patch: free previously allocated
      pubkeys in src/ecdh_crypto.c, src/ecdh_gcrypt.c.
    - debian/patches/CVE-2025-8277-4.patch: avoid leaking ecdh keys in
      src/ecdh_mbedcrypto.c, src/wrapper.c.
    - CVE-2025-8277
  * SECURITY UPDATE: Improper sanitation of paths received from SCP servers
    - debian/patches/CVE-2026-0964.patch: reject invalid paths received
      through scp in src/scp.c.
    - CVE-2026-0964
  * SECURITY UPDATE: DoS via improper configuration file handling
    - debian/patches/CVE-2026-0965.patch: do not attempt to read
      non-regular and too large configuration files in
      include/libssh/misc.h, include/libssh/priv.h, src/bind_config.c,
      src/config.c, src/dh-gex.c, src/known_hosts.c, src/knownhosts.c,
      src/misc.c, tests/unittests/torture_config.c.
    - CVE-2026-0965
  * SECURITY UPDATE: Buffer underflow in ssh_get_hexa() on invalid input
    - debian/patches/CVE-2026-0966-1.patch: avoid heap buffer underflow in
      ssh_get_hexa in src/misc.c.
    - debian/patches/CVE-2026-0966-2.patch: test coverage for ssh_get_hexa
      in tests/unittests/torture_misc.c.
    - debian/patches/CVE-2026-0966-3.patch: update guided tour to use
      SHA256 fingerprints in doc/guided_tour.dox.
    - CVE-2026-0966
  * SECURITY UPDATE: DoS via inefficient regular expression processing
    - debian/patches/CVE-2026-0967.patch: avoid recursive matching (ReDoS)
      in src/match.c, tests/unittests/torture_config.c.
    - CVE-2026-0967
  * SECURITY UPDATE: DoS due to malformed SFTP message
    - debian/patches/CVE-2026-0968-1.patch: sanitize input handling in
      sftp_parse_longname() in src/sftp.c.
    - debian/patches/CVE-2026-0968-2.patch: reproducer for invalid longname
      data in tests/unittests/CMakeLists.txt,
      tests/unittests/torture_unit_sftp.c.
    - CVE-2026-0968

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 13 Feb 2026 10:22:49 -0500

libssh (0.9.6-2ubuntu0.22.04.5) jammy-security; urgency=medium

  * SECURITY UPDATE: NULL pointer dereference
    - debian/patches/CVE-2025-8114.patch: sets rc to SSH_ERROR prior to goto
      error in ssh_make_sessionid() of src/kex.c.
    - CVE-2025-8114

 -- Ian Constantin <ian.constantin@canonical.com>  Wed, 29 Oct 2025 14:58:26 +0200

libssh (0.9.6-2ubuntu0.22.04.4) jammy-security; urgency=medium

  * SECURITY UPDATE: Write beyond bounds in binary to base64 conversion
    functions
    - debian/patches/CVE-2025-4877.patch: prevent integer overflow and
      potential OOB.
    - CVE-2025-4877
  * SECURITY UPDATE: Use of uninitialized variable in
    privatekey_from_file()
    - debian/patches/CVE-2025-4878-1.patch: initialize pointers where
      possible.
    - debian/patches/CVE-2025-4878-2.patch: properly check return value to
      avoid NULL pointer dereference.
    - CVE-2025-4878
  * SECURITY UPDATE: OOB read in sftp_handle function
    - debian/patches/CVE-2025-5318.patch: fix possible buffer overrun.
    - CVE-2025-5318
  * SECURITY UPDATE: ssh_kdf() returns a success code on certain failures
    - debian/patches/CVE-2025-5372-pre1.patch: Reformat ssh_kdf().
    - debian/patches/CVE-2025-5372.patch: simplify error checking and
      handling of return codes in ssh_kdf().
    - CVE-2025-5372
  * SECURITY UPDATE: Missing packet filter may expose to variant of
    Terrapin attack
    - debian/patches/missing_packet_filter.patch: implement missing packet
      filter for DH GEX.
    - No CVE number

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 02 Jul 2025 14:48:47 -0400

libssh (0.9.6-2ubuntu0.22.04.3) jammy-security; urgency=medium

  * SECURITY UPDATE: code injection via ProxyCommand/ProxyJump hostname
    - debian/patches/CVE-2023-6004-*.patch: validate hostnames.
    - CVE-2023-6004
  * SECURITY UPDATE: DoS via incorrect return value checks
    - debian/patches/CVE-2023-6918-*.patch: check return values.
    - CVE-2023-6918

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 11 Jan 2024 07:44:15 -0500

libssh (0.9.6-2ubuntu0.22.04.2) jammy-security; urgency=medium

  * SECURITY UPDATE: Prefix truncation attack on BPP
    - debian/patches/CVE-2023-48795-1.patch: add client side mitigation.
    - debian/patches/CVE-2023-48795-2.patch: add server side mitigations.
    - debian/patches/CVE-2023-48795-3.patch: strip extensions from both kex
      lists for matching.
    - debian/patches/CVE-2023-48795-4.patch: tests: adjust calculation to
      strict kex.
    - CVE-2023-48795

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 18 Dec 2023 17:30:05 -0500

libssh (0.9.6-2ubuntu0.22.04.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Potential NULL dereference during rekeying with
    algorithm guessing
    - debian/patches/CVE-2023-1667-*.patch: upstream patches to fix the
      issue.
    - CVE-2023-1667
  * SECURITY UPDATE: Authorization bypass in pki_verify_data_signature
    - debian/patches/CVE-2023-2283-*.patch: upstream patches to fix the
      issue.
    - CVE-2023-2283

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 26 May 2023 06:31:25 -0400

libssh (0.9.6-2build1) jammy; urgency=high

  * No change rebuild for ppc64el baseline bump.

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 24 Mar 2022 17:13:50 +0100

libssh (0.9.6-2) unstable; urgency=medium

  [ Helmut Grohne ]
  * debian/control: Add preferred real zlib1g-dev build dep.
    As libz-dev is purely virtual.
  * Mark build dependencies for running unit tests.
    This reduces dependencies for bootstrapping. (Closes: #1002598)

  [ Martin Pitt ]
  * debian/copyright: Update and generalize. Replace some over-specific
    patterns with globs. A lot of files did not exist any more, a lot of new
    copyrights were missing.  Spotted by lintian.
  * Adjust lintian overrides to renamed tag.
  * Quiesce very-long-line-length-in-source-file lintian warning for test keys
  * Mark Debian specific patches as not needing upstream forwarding.
    This quiesces two lintian complaints for `patch-not-forwarded-upstream`.
    Don't mark 1003-custom-lib-names.patch, as that one actually is suitable
    for upstream.

 -- Martin Pitt <mpitt@debian.org>  Sat, 25 Dec 2021 19:36:01 +0100

libssh (0.9.6-1) unstable; urgency=medium

  * New upstream version 0.9.6:
    - Fix possible heap-buffer overflow when rekeying with different key
      exchange mechanism (Closes: #993046, CVE-2021-3634)
  * Refresh 2004-install-static-lib.patch for new upstream version
  * Bump Standards-Version to 4.6.0. No changes necessary.
  * debian/control: Declare Rules-Requires-Root: no

 -- Martin Pitt <mpitt@debian.org>  Sat, 28 Aug 2021 12:51:05 +0200

# For older changelog entries, run 'apt-get changelog libssh-4'
